AZ-305 Questions 101-110: Application Architecture, Migration, and Network Design

0
0

AZ-305 questions 101-110

AZ-305 Questions 101-110: Application Architecture, Migration, and Network Design

Use this AZ-305 questions 101-110 practice set to continue your Microsoft Azure Solutions Architect Expert review with original, exam-style scenarios on application architecture, migration planning, hybrid connectivity, network security, and global routing. These questions are based on public Microsoft objectives and documentation — no exam dumps, no copied proprietary items, just realistic practice.

Exam:
AZ-305 Designing Microsoft Azure Infrastructure Solutions
Range:
Questions 101-110
Primary objective:
Application architecture, migrations, and network design
Difficulty:
Architect-level scenario decisions
Series note: This post continues the AZ-305 sequence after AZ-305 Questions 91-100: Security, Data, BCDR, and Well-Architected Review. Questions 101-110 move into integration patterns, API management, migration decisions, hybrid connectivity, centralized inspection, and global routing.
Exam tip: For AZ-305 architecture questions, separate the type of communication from the placement of the service. A queue, topic, event router, API gateway, global edge service, DNS router, and firewall all solve different problems even when the answer choices sound similar.

AZ-305 questions 101-110

Question 101 Messaging design

Selecting a messaging pattern for filtered downstream processing

A retail platform accepts orders from a web app. Several downstream systems must process order events independently: fulfillment needs all paid orders, fraud analytics needs high-value orders, and the marketing system needs only opt-in customer orders. If one downstream system is unavailable, the others must continue processing. The design should support reliable delivery, filtering, and independent consumers.

Choose one answer.

  1. Use one Azure Storage queue and have all downstream systems read from the same queue.
  2. Use an Azure Service Bus topic with separate subscriptions and subscription filters for each downstream system.
  3. Write order events to a single Azure Table and have each system poll the table every hour.
  4. Send order events directly from the web app to each downstream system by using synchronous HTTP calls.
Correct answer: B

Explanation: Azure Service Bus topics provide publish/subscribe messaging. Each subscription receives an independent copy of matching messages, and filters can route only relevant messages to each consumer. This matches the requirements for reliable decoupling, independent downstream processing, and targeted delivery.

Why the other options are wrong: A creates competing consumers, so each message is consumed by only one reader rather than independently by all required systems. C adds polling latency and does not provide native brokered delivery semantics. D tightly couples the web app to every downstream service and lets one dependency affect order intake.

Objective/domain: Design an application architecture: messaging architecture and integration.

Reference: Microsoft Learn: Service Bus topics, subscriptions, and filters

Question 102 Event-driven design

Triggering lightweight processing when files arrive

An image-processing workload stores uploaded images in Azure Blob Storage. A serverless function must start within seconds when a new blob is created. The solution should avoid custom polling code and should integrate with managed Azure event routing.

Choose one answer.

  1. Configure Azure Event Grid events for the storage account and subscribe an Azure Function to blob-created events.
  2. Create a timer-triggered function that scans every container once per hour.
  3. Enable Azure Backup for the storage account and run processing after each backup job completes.
  4. Use Azure Traffic Manager to route uploads to the closest region.
Correct answer: A

Explanation: Azure Event Grid is designed for event-driven architectures and supports system events from Azure Storage, including blob-created events. Subscribing an Azure Function provides low-latency, managed event handling without custom polling.

Why the other options are wrong: B can miss the near-real-time requirement and introduces polling logic. C is for recovery, not application event processing. D performs DNS-based traffic routing and does not trigger compute from storage events.

Objective/domain: Design an application architecture: event-driven architecture and serverless integration.

Reference: Microsoft Learn: Azure Event Grid overview

Question 103 API governance

Publishing internal APIs for partner consumption

A company has multiple App Service APIs that will be consumed by external partners. The architecture must provide a single front door for APIs, enforce subscription keys and quotas, support versioning, and give partners a developer portal for onboarding. The backend applications should not implement those cross-cutting API management capabilities themselves.

Choose one answer.

  1. Azure API Management
  2. Azure Bastion
  3. Azure Load Balancer with inbound NAT rules
  4. Azure Container Registry
Correct answer: A

Explanation: Azure API Management centralizes API publishing, policy enforcement, throttling, quotas, versioning, authentication integration, and developer onboarding. It is the intended Azure service for managing APIs in front of backend services.

Why the other options are wrong: B provides secure RDP/SSH access to virtual machines. C is a layer 4 load-balancing feature and does not provide API policies or a developer portal. D stores container images and does not publish or govern APIs.

Objective/domain: Design an application architecture: API integration and governance.

Reference: Microsoft Learn: Azure API Management overview

Question 104 Caching

Reducing database read pressure for session and lookup data

An e-commerce application performs frequent reads for product lookup data and user session state. The database tier is healthy but over-provisioned because of repeated low-latency reads. The design should reduce database load while keeping cached data available to multiple application instances.

Choose one answer.

  1. Deploy Azure Cache for Redis and update the application to cache appropriate lookup and session data.
  2. Move all users to a single larger App Service instance so memory cache is local to that instance.
  3. Enable soft delete on the database.
  4. Use Azure Monitor alerts to restart the database when CPU exceeds a threshold.
Correct answer: A

Explanation: Azure Cache for Redis provides an in-memory, shared cache that multiple application instances can use for low-latency reads and session-style data patterns. It helps reduce repeated reads against the primary data store while supporting scale-out web tiers.

Why the other options are wrong: B reduces horizontal scalability and creates single-instance risk. C improves recovery from deletes but does not reduce read pressure. D reacts to symptoms and can make availability worse; it does not introduce a cache tier.

Objective/domain: Design an application architecture: caching solution for applications.

Reference: Microsoft Learn: Azure Cache for Redis overview

Question 105 Configuration management

Centralizing feature flags and configuration values

A workload contains several App Service apps and Azure Functions across development, test, and production environments. Developers need a central place to manage non-secret configuration and feature flags. Secrets must remain in Key Vault, but applications should be able to reference them without copying secret values into source control.

Choose one answer.

  1. Use Azure App Configuration for centralized settings and feature flags, with Key Vault references for secrets.
  2. Store all application settings, including secrets, in a JSON file committed to the repository.
  3. Create a separate storage account for each setting and read values from blob metadata.
  4. Use Azure Policy assignments as the runtime configuration store for the applications.
Correct answer: A

Explanation: Azure App Configuration is designed to centralize application settings and feature flags. It can integrate with Key Vault references so secret values remain in Key Vault while applications resolve them securely at runtime.

Why the other options are wrong: B exposes secrets and makes environment changes risky. C is an awkward storage pattern and does not provide feature management capabilities. D governs Azure resource compliance; it is not an application configuration service.

Objective/domain: Design an application architecture: application configuration management.

Reference: Microsoft Learn: Azure App Configuration overview

Question 106 Migration assessment

Building migration waves from discovered server dependencies

An organization plans to migrate 300 VMware virtual machines to Azure. The architecture team must discover servers, assess Azure readiness and sizing, and identify application dependencies so migration waves can be planned with minimal business disruption. The team wants a Microsoft-provided migration planning tool.

Choose one answer.

  1. Azure Migrate discovery and assessment
  2. Azure Front Door rules engine
  3. Microsoft Defender for Cloud regulatory compliance only
  4. Azure Cost Management budgets
Correct answer: A

Explanation: Azure Migrate provides discovery, assessment, dependency analysis, and migration tooling for servers and workloads. It is the correct service for evaluating VMware environments, estimating Azure sizing, and grouping workloads into migration waves.

Why the other options are wrong: B handles application delivery at the edge. C helps assess security posture and compliance but does not plan server migrations. D can manage spending alerts but does not discover dependencies or assess migration readiness.

Objective/domain: Design migrations: evaluate on-premises servers, data, and applications for migration.

Reference: Microsoft Learn: Azure Migrate overview

Question 107 Database migration

Migrating SQL Server databases with minimal downtime

A company will migrate several on-premises SQL Server databases to Azure SQL Managed Instance. The databases support a line-of-business application with a short maintenance window. The design should minimize downtime and use a managed migration approach rather than manual backup-copy-restore steps for each database.

Choose one answer.

  1. Use Azure Database Migration Service with an online migration path to Azure SQL Managed Instance where supported.
  2. Export each database to a CSV file and import it manually after the application is stopped.
  3. Use Azure Site Recovery to replicate the SQL Server data files directly into Azure SQL Managed Instance.
  4. Create an Azure Storage account with GRS and copy the MDF files to a blob container.
Correct answer: A

Explanation: Azure Database Migration Service supports managed database migration scenarios and can provide online migration paths that reduce downtime for supported SQL Server to Azure SQL targets. For an architect design question, the key is selecting a migration service that aligns with database workload migration and short outage requirements.

Why the other options are wrong: B is manual, disruptive, and loses SQL Server database fidelity. C is a VM disaster recovery service, not a migration mechanism into Azure SQL Managed Instance. D only moves files to storage and does not perform a supported managed database migration into Azure SQL Managed Instance.

Objective/domain: Design migrations: recommend a solution for migrating databases.

Reference: Microsoft Learn: Azure Database Migration Service overview

Question 108 Hybrid connectivity

Choosing private connectivity from datacenters to Azure

A financial services company needs private connectivity between two on-premises datacenters and Azure. The connection must avoid the public internet, support predictable throughput, and connect to Azure virtual networks through private peering. The company is willing to work with a connectivity provider.

Choose one answer.

  1. Azure ExpressRoute
  2. Point-to-site VPN from each administrator laptop
  3. Azure Bastion
  4. Azure DNS private resolver only
Correct answer: A

Explanation: Azure ExpressRoute provides private connectivity between on-premises networks and Microsoft cloud services through a connectivity provider. Private peering connects customer networks to Azure virtual networks without sending traffic over the public internet.

Why the other options are wrong: B is for individual client connectivity and rides over the internet. C provides browser-based administrative access to VMs, not datacenter-to-Azure private WAN connectivity. D helps resolve DNS across networks but does not provide the network connection itself.

Objective/domain: Design network solutions: connectivity between Azure and on-premises networks.

Reference: Microsoft Learn: ExpressRoute overview

Question 109 Network security

Forcing spoke-to-internet traffic through central inspection

An enterprise uses a hub-and-spoke Azure network. Security requires all outbound internet traffic from spoke virtual networks to pass through a centrally managed firewall in the hub. The design must apply consistently to workload subnets without placing a firewall in every spoke.

Choose one answer.

  1. Deploy Azure Firewall in the hub and associate user-defined routes on spoke subnets that send default traffic to the firewall private IP address.
  2. Enable service endpoints on every subnet and remove all route tables.
  3. Create a public IP address for each virtual machine and allow outbound traffic directly.
  4. Use Azure Traffic Manager profiles for each subnet.
Correct answer: A

Explanation: A hub-and-spoke design commonly centralizes shared network security services in the hub. User-defined routes on spoke subnets can direct outbound traffic, such as 0.0.0.0/0, to Azure Firewall for inspection and policy enforcement before traffic reaches the internet.

Why the other options are wrong: B can restrict access to selected Azure services but does not force internet egress through inspection. C bypasses centralized security. D is DNS-based endpoint routing and does not steer subnet traffic through a firewall.

Objective/domain: Design network solutions: optimize network security and routing.

Reference: Microsoft Learn: Azure Firewall documentation

Question 110 Global routing

Routing public clients across non-HTTP regional endpoints

A legacy application exposes public endpoints in two Azure regions. The client protocol is not HTTP or HTTPS, and the architecture only needs DNS-based routing to send clients to the closest healthy endpoint. The solution should not terminate TLS or proxy application traffic at layer 7.

Choose one answer.

  1. Azure Traffic Manager
  2. Azure Front Door Standard/Premium
  3. Azure Application Gateway WAF v2
  4. Azure Private Link service
Correct answer: A

Explanation: Azure Traffic Manager is a DNS-based traffic load balancer that can route clients to healthy endpoints based on routing methods such as priority, weighted, performance, or geographic. Because it works at DNS level, it is appropriate when the requirement is public endpoint selection rather than HTTP/S layer 7 proxying.

Why the other options are wrong: B is a global HTTP/S layer 7 edge service and would be the stronger choice for web applications that need edge proxy features. C is a regional layer 7 load balancer/WAF inside a virtual network. D exposes private services through Private Link and does not provide public DNS-based multi-region routing.

Objective/domain: Design network solutions: load balancing and routing.

Reference: Microsoft Learn: Traffic Manager overview

Answer key summary

Question Answer Key decision
101BSelecting a messaging pattern for filtered downstream processing
102ATriggering lightweight processing when files arrive
103APublishing internal APIs for partner consumption
104AReducing database read pressure for session and lookup data
105ACentralizing feature flags and configuration values
106ABuilding migration waves from discovered server dependencies
107AMigrating SQL Server databases with minimal downtime
108AChoosing private connectivity from datacenters to Azure
109AForcing spoke-to-internet traffic through central inspection
110ARouting public clients across non-HTTP regional endpoints
Review focus: If you missed more than two questions, revisit the AZ-305 skills for application architecture and infrastructure design. Pay special attention to when Azure services are brokered messaging, event routing, API governance, private WAN connectivity, layer 7 edge delivery, DNS routing, or subnet-level traffic inspection.

Sources

📚 More questions from: AZ-305: Azure Solutions Architect

Related QuestionMORE FROM AUTHOR